HP StorageWorks 8/80 HP StorageWorks Fabric OS 6.2 administrator guide (5697-0 - Page 149

It is possible in this scenario that one or both of the protected endpoints will be behind a network address translation (NAT) node, in which case the tunneled packets will have to be UDP-encapsulated so that port numbers in the UDP headers can be used to identify individual endpoints behind the NAT. Figure 5 Protected endpoints configuration A possible drawback of end-to-end security is that various applications that require the ability to inspect or modify a transient packet will fail when end-to-end confidentiality is employed. Various QoS solutions, traffic shaping, and firewalling applications will be unable to determine what type of packet is being transmitted and will be unable to make the decisions that they are supposed to make. Gateway-to-Gateway Tunnel In this scenario, neither endpoint of the IP connection implements IPsec, but the network nodes between them protect traffic for part of the way (see Figure 6). Protection is transparent to the endpoints, and depends on ordinary routing to send packets through the tunnel endpoints for processing. Each endpoint would announce the set of addresses behind it, and packets would be sent in tunnel mode where the inner IP header would contain the IP addresses of the actual endpoints. Figure 6 Gateway tunnel configuration Endpoint-to-Gateway Tunnel In this scenario, a protected endpoint (typically a portable computer) connects back to its corporate network through an IPsec-protected tunnel (see Figure 7). It might use this tunnel to access information only on the corporate network, or it might tunnel all of its traffic back through the corporate network in order to take advantage of protection provided by a corporate firewall against Internet-based attacks. In either case, the protected endpoint will want an IP address associated with the security gateway so that packets returned to it will go to the security gateway and be tunneled back. Figure 7 Endpoint to gateway tunnel configuration RoadWarrior Configuration In endpoint-to-endpoint security, packets are encrypted and decrypted by the host that produces or consumes the traffic. In gateway-to-gateway example, a router on the network encrypts and decrypts the packets on behalf of the hosts on a protected network. A combination of the two is referred to as a RoadWarrior configuration where a host on the internet requires access to a network through a security gateway that is protecting the network. Fabric OS 6.2 administrator guide 147